socks5systemz

General

Target

4433bf3a29e3bfe87c5ad1de6f23caa6.exe
Size

4.8MB
Sample

240613-bxdfwsyhqa
MD5

4433bf3a29e3bfe87c5ad1de6f23caa6
SHA1

d4a77e5f2a34ea964531c6ffda76b8a6b1ed06e2
SHA256

395a04d595a1e12f6d75f23808ccef0cf0484c29d706c59882f68057f860ed3f
SHA512

80cbf6985df943e532af58f82116359327a23b66fe892f792c38211908eb080793c7316f9365bb52bd43e3940ec6d752f3a46a0c0ce617876c9f0624ddde67f1
SSDEEP

98304:mq0VPCgwzTZCMW0l1e6x3Pe5tRZfuWQ2w+IFjHuoz:6PCdXDW0m6FPCRtFCuoz

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

ckaoaox.net

http://ckaoaox.net/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8cfb13c3ec95

bnbzijm.com

http://bnbzijm.com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c4ed969832

Targets

- Target
  
  4433bf3a29e3bfe87c5ad1de6f23caa6.exe
- Size
  
  4.8MB
- MD5
  
  4433bf3a29e3bfe87c5ad1de6f23caa6
- SHA1
  
  d4a77e5f2a34ea964531c6ffda76b8a6b1ed06e2
- SHA256
  
  395a04d595a1e12f6d75f23808ccef0cf0484c29d706c59882f68057f860ed3f
- SHA512
  
  80cbf6985df943e532af58f82116359327a23b66fe892f792c38211908eb080793c7316f9365bb52bd43e3940ec6d752f3a46a0c0ce617876c9f0624ddde67f1
- SSDEEP
  
  98304:mq0VPCgwzTZCMW0l1e6x3Pe5tRZfuWQ2w+IFjHuoz:6PCdXDW0m6FPCRtFCuoz
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2